Description
Heap-based buffer overflow in the parse_codes function in archive_read_support_format_rar.c in libarchive before 3.2.1 allows remote attackers to execute arbitrary code via a RAR file with a zero-sized dictionary.
References (11)
Core 11
Core References
Third Party Advisory vendor-advisory
x_refsource_redhat
http://rhn.redhat.com/errata/RHSA-2016-1844.html
Vendor Advisory x_refsource_confirm
http://www.oracle.com/technetwork/topics/security/linuxbulletinjul2016-3090544.html
Exploit, Third Party Advisory x_refsource_misc
http://blog.talosintel.com/2016/06/the-poisoned-archives.html
Exploit, Third Party Advisory x_refsource_misc
http://www.talosintel.com/reports/TALOS-2016-0154/
Issue Tracking, Patch x_refsource_confirm
https://github.com/libarchive/libarchive/issues/719
Vendor Advisory x_refsource_confirm
http://www.oracle.com/technetwork/topics/security/bulletinjul2016-3090568.html
Third Party Advisory, VDB Entry vdb-entry
x_refsource_bid
http://www.securityfocus.com/bid/91331
Issue Tracking x_refsource_confirm
http://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=1348444
Third Party Advisory vendor-advisory
x_refsource_gentoo
https://security.gentoo.org/glsa/201701-03
Third Party Advisory vendor-advisory
x_refsource_debian
http://www.debian.org/security/2016/dsa-3657
Issue Tracking, Patch x_refsource_confirm
https://github.com/libarchive/libarchive/commit/05caadc7eedbef471ac9610809ba683f0c698700
Scores
CVSS v3
7.8
EPSS
0.0476
EPSS Percentile
90.8%
Attack Vector
LOCAL
CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Details
CWE
CWE-119
Status
published
Products (8)
libarchive/libarchive
< 3.2.0
redhat/enterprise_linux_desktop
7.0
redhat/enterprise_linux_hpc_node
7.0
redhat/enterprise_linux_hpc_node_eus
7.2
redhat/enterprise_linux_server
7.0
redhat/enterprise_linux_server_aus
7.2
redhat/enterprise_linux_server_eus
7.2
redhat/enterprise_linux_workstation
7.0
Published
Sep 21, 2016
Tracked Since
Feb 18, 2026